aee1b4f7265fb233f04d185dd864d404158566c5b09ba178b29ccd7a176c9328

Sharing

Copy URL Twitter E-mail

General

Target

aee1b4f7265fb233f04d185dd864d404158566c5b09ba178b29ccd7a176c9328
Size

117KB
MD5

41be5fcb51917245eb3fd7a015c17a10
SHA1

c843f3dd5ae4eaf3d8f1af482fa0dfdc7c498fee
SHA256

aee1b4f7265fb233f04d185dd864d404158566c5b09ba178b29ccd7a176c9328
SHA512

908e06126fe8981cb936cdfdca5d404a6015e4e7d1a0c244736dfa5ad68ea1b245e7c0a3d8779d3a772c9755329fc5d7a2f7cf4c4477bb7bd941a73ad3df7f4e
SSDEEP

1536:xeCVTd5dCDHDOny3h9DtcjXIrPzc4pSttMTiQHApfdhtp2rjNyI6KHH1vucF5ZO/:4AdMqiED0I1ttnjX2XNydKnP0dOefT

Score

N/A

Malware Config

Signatures

Files

aee1b4f7265fb233f04d185dd864d404158566c5b09ba178b29ccd7a176c9328
.exe windows x86

4b0349cb5dde091c2fb0e50a02be5440

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetDeviceCaps
D3DKMTSetProcessSchedulingPriorityClass
GetRandomRgn
GetStockObject
CreateCompatibleBitmap
DeleteObject
GetDIBits
BitBlt
DeleteDC
GetRgnBox
SelectObject
SelectClipRgn
CreateCompatibleDC
CombineRgn
OffsetRgn
GdiAlphaBlend
CreateRectRgn
CreateDIBSection

user32

GetClassNameW
UpdateWindow
SetWindowTextW
DestroyIcon
GetWindowThreadProcessId
GetWindowRect
OffsetRect
SetClassLongW
MonitorFromWindow
AdjustWindowRectEx
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsW
GetSystemMetrics
MsgWaitForMultipleObjectsEx
PostMessageW
RegisterErrorReportingDialog
RegisterGhostWindow
HungWindowFromGhostWindow
InternalGetWindowIcon
GhostWindowFromHungWindow
RegisterFrostWindow
OpenThreadDesktop
GetWindow
CloseDesktop
GetPropW
UnregisterSessionPort
RegisterSessionPort
CheckDesktopByThreadId
DwmStopRedirection
DwmStartRedirection
SetForegroundWindow
IsHungAppWindow
MessageBeep
IsWindowEnabled
EnumWindows
FlashWindowEx
SendMessageTimeoutW
IsWindow
GetCaretBlinkTime
EndTask
OpenDesktopW
IsDialogMessageW
GetAncestor
SetThreadDesktop
EndPaint
ClientToScreen
InternalGetWindowText
GetUpdateRgn
SetTimer
IsIconic
FillRect
KillTimer
IsZoomed
GetTitleBarInfo
GetWindowInfo
LogicalToPhysicalPoint
GetClientRect
BeginPaint
ChangeWindowMessageFilterEx
InvalidateRect
GetWindowLongW
GetWindowTextW
GetDCEx
SetWindowLongW
ShowWindow
GetSysColorBrush
CreateDialogParamW
PostThreadMessageW
IsWindowVisible
GetGuiResources
SetWindowPos
LoadStringW
LoadIconW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterPowerSettingNotification
ReleaseDC
GetDC
PostQuitMessage
DestroyWindow
UnregisterPowerSettingNotification
DefWindowProcW
CreateWindowExW
RegisterClassExW
GetThreadDesktop
GetUserObjectInformationW
SystemParametersInfoW
SendMessageW

msvcrt

memset
_unlock
__dllonexit
_wcsnicmp
_onexit
_except_handler4_common
_CIsqrt
memcpy
_wcsupr_s
wcschr
wcsncpy_s
wcsrchr
??_U@YAPAXI@Z
??_V@YAXPAX@Z
rand
srand
_wcsicmp
_purecall
_lock
_vsnwprintf
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memmove
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
_ftol2

ntdll

DbgPrompt
NtQuerySystemInformation
DbgPrintEx
RtlCaptureStackBackTrace
WinSqmAddToStreamEx
WinSqmIsOptedIn
NtAcceptConnectPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtRequestPort
NtConnectPort
NtRequestWaitReplyPort
RtlUpcaseUnicodeChar
WinSqmIncrementDWORD
RtlNtStatusToDosError
EtwEventWriteNoRegistration
NtClose
NtWaitForSingleObject
NtOpenEvent
RtlFreeSid
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
RtlAllocateAndInitializeSid
NtQueryInformationProcess
NtReplyPort
NtCreateWaitablePort
RtlInitUnicodeString
RtlInsertElementGenericTable
RtlIsGenericTableEmpty
RtlLookupElementGenericTable
RtlInitializeGenericTable
EtwEventEnabled
EtwEventRegister
EtwEventUnregister
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
WinSqmAddToStream
EtwEventWrite

uxtheme

CloseThemeData
OpenThemeData

imm32

ImmDisableIME

dwmredir

DwmRedirectionManagerLockMemoryAllocations
DwmRedirectionManagerEnableMMCSS
DwmRedirectionManagerPlayingVideo
DwmInitializeTransport
DwmShutdownTransport
DwmRedirectionManagerShutdown
DwmRedirectionManagerShouldRemainOnHibernate
DwmRedirectionManagerDispatchMessage
DwmRedirectionManagerFailMessage
DwmRedirectionManagerWaitForMultipleObjects
DwmVersionCheck

dwmcore

MilChannel_CommitChannel
MilComposition_WaitForNextMessage
MilCompositionEngine_UpdateSchedulerSettings
MilResource_SendCommand
MilChannel_GetMarshalType
MilConnection_CreateChannel
MilConnection_HandleSfmEventOnPartition
MilConnection_ClearSfmEventOnPartition
MilConnection_DestroyChannel
MilComposition_PeekNextMessage

kernel32

InterlockedExchange
GetStartupInfoA
GetModuleHandleA
LocalAlloc
LocalFree
ResumeThread
DuplicateHandle
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
WaitForMultipleObjectsEx
IsWow64Process
RegSetValueExW
RegCreateKeyExW
QueryPerformanceCounter
SetThreadPriority
CreateThread
OpenProcess
ReleaseMutex
CreateMutexW
SetEvent
OpenEventW
SignalObjectAndWait
UnhandledExceptionFilter
GetCurrentThread
TerminateThread
TerminateProcess
DebugBreak
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree
IsDebuggerPresent
GetModuleHandleW
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
DelayLoadFailureHook
Sleep
GetUserDefaultLangID
FormatMessageW
GetExitCodeThread
WaitForSingleObject
RegisterWaitForSingleObject
GetThreadId
GetTickCount
ProcessIdToSessionId
CreateEventW
GetCurrentProcessId
SetProcessWorkingSetSize
GetSystemTimeAsFileTime
RegGetValueW
GetSystemInfo
GetCurrentProcess
GetProcAddress
LoadLibraryW
SetErrorMode
QueryFullProcessImageNameW
ExitProcess
GetCurrentThreadId
SetProcessShutdownParameters
SetUnhandledExceptionFilter
HeapSetInformation
WerSetFlags
SetLastError
CloseHandle
GetLastError
GetTickCount64
DeleteCriticalSection
InitializeCriticalSection
QueueUserWorkItem
LeaveCriticalSection
EnterCriticalSection

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nqeyalt
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4b0349cb5dde091c2fb0e50a02be5440

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

msvcrt

ntdll

uxtheme

imm32

dwmredir

dwmcore

kernel32

Sections

.text Size: 75KB - Virtual size: 75KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 30KB - Virtual size: 32KB

nqeyalt Size: - Virtual size: 4KB

.text
Size: 75KB - Virtual size: 75KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 30KB - Virtual size: 32KB

nqeyalt
Size: - Virtual size: 4KB